Training Guide for Writing BES Custom Content (Windows)

BigFix, Inc. Emeryville, CA

Last Modified: June 17, 2005 Version 5.1

1 ©2005 by BigFix, Inc.

© 1998–2005 BigFix, Inc. All rights reserved.

BigFix®, Fixlet® and "Fix it before it fails"® are registered trademarks of BigFix, Inc. i- prevention, Powered by BigFix, Relevance Engine, and related BigFix logos are trademarks of BigFix, Inc. All other product names, trade names, trademarks, and logos used in this documentation are the property of their respective owners. BigFix’s use of any other company’s trademarks, trade names, product names and logos or images of the same does not necessarily constitute: (1) an endorsement by such company of BigFix and its products, and (2) an endorsement of the company or its products by BigFix.

No part of this documentation may be reproduced, transmitted, or otherwise distributed in any form or by any means (electronic or otherwise) without the prior written consent of BigFix, Inc. You may not use this documentation for any purpose except in connection with your use or evaluation of BigFix software and any other use, including for reverse engineering such software or creating compatible software, is prohibited. If the license to the software which this documentation accompanies is terminated, you must immediately return this documentation to BigFix, Inc. and destroy all copies you may have. All inquiries regarding the foregoing should be addressed to: BigFix, Inc. 5915 Hollis Street Emeryville, CA 94608-2017

2 ©2005 by BigFix, Inc.

Table of Contents

OVERVIEW...... 6 REFERENCES ...... 6 CONVENTIONS USED IN THIS MANUAL ...... 7 Examples...... 7 TYPES OF CUSTOM CONTENT...... 8 What is a Fixlet® message?...... 8 Fixlet messages Vs. BES Tasks ...... 8 BES Retrieved Properties ...... 9 BES Custom Actions ...... 9 INITIAL QUERY ANALYSIS ...... 10 THE QNA PROGRAM ...... 10 THE STRUCTURE OF BES RELEVANCE - OBJECT TYPES...... 11 BASIC BOOLEANS ...... 13 Existence ...... 13 Practice with QNA:...... 14 Practice Using QNA: ...... 14 Comparison...... 14 OPERATORS ...... 15 FILE SYSTEM OBJECTS...... 16 The Folder Object...... 16 Creation Methods...... 16 Properties ...... 17 The File Object ...... 18 Creation Methods...... 18 Properties ...... 18 Practice with QNA:...... 20 Plurals...... 20 Applications ...... 20 Practice with QNA:...... 22 Versions...... 22 Practice With QNA:...... 23 Operating System...... 24 Practice with QNA:...... 24 Strings ...... 24 Practice With QNA:...... 26 Registry Commands ...... 26 Creation Methods...... 28 Properties ...... 28 Practice with QNA:...... 30 3 ©2005 by BigFix, Inc. Time...... 30 Services ...... 31 Creation Methods...... 31 Properties ...... 32 Practice with QNA:...... 33 Hardware ...... 33 RAM ...... 33 Processor ...... 33 Creation Methods...... 33 Properties ...... 34 Network Adapter ...... 35 Properties ...... 35 Practice with QNA:...... 36 PRACTICE PROBLEM ANSWERS ...... 37 ADVANCED BES RELEVANCE SYNTAX...... 42 If/Else/Then...... 42 Practice With QNA...... 42 Whose/It – Filtering a list ...... 43 Practice With QNA:...... 45 Whose/It – Beyond Filtering ...... 46 Practice With QNA...... 47 Avoiding Error Messages ...... 47 Practice with QNA:...... 49 Using it without a whose ...... 49 Querying Multiple Properties of an Object...... 49 Outputting Multiple Properties ...... 50 ANSWERS TO PRACTICE PROBLEMS: ...... 52 THE BIGFIX ACTION LANGUAGE...... 54 RELEVANCE SUBSTITUTION ...... 55 FILE SYSTEM COMMANDS...... 55 delete...... 56 copy...... 56 move ...... 56 Practice Problems...... 57 EXECUTION COMMANDS ...... 58 run...... 58 wait...... 59 Practice Problems: ...... 60 dos...... 60 Practice Problems: ...... 61 DOWNLOADS...... 61 continue if...... 61 download...... 62 Practice Problems...... 63 REGISTRY COMMANDS ...... 64

4 ©2005 by BigFix, Inc. regset...... 64 regdelete...... 65 Practice Problems: ...... 66 COMMENTS ...... 66 // ...... 66 OTHER ACTION COMMANDS ...... 66 action requires restart...... 66 action may require restart ...... 67 action parameter query...... 67 set clock...... 68 restart...... 68 Practice Problems: ...... 69 PRACTICE PROBLEM ANSWERS:...... 70 APPENDIX A: QNA ERROR MESSAGES...... 73 APPENDIX B: STRATEGIES FOR FIXLETS...... 79 USING RELEVANCE TO CHECK FOR A CERTAIN PROBLEM ...... 79

5 ©2005 by BigFix, Inc.

Overview

The purpose of this guide is to equip the reader with the skills needed to create BES Custom Actions, Fixlet® messages, BES tasks, and BES Retrieved Properties for the BigFix Enterprise System (BES). The core elements of all these elements are the BigFix Relevance Language and the BigFix Action Language. This guide outlines the most useful commands from each of these languages and provides examples and exercises to assist with instruction.

In order to get the most out of this guide, the reader should have a working knowledge of the BES Console and the BigFix Development Environment (BDE) if they intend to use it. Since this guide will focus on the relevance and action languages, this information should be applicable to content creation from either the BES Console or BDE.

In order to get the most out of this document, you will need access to the BigFix Query Analyser (QNA), the BES Console, and BDE (if you intend to use it). You can download QNA here: http://support.bigfix.com/fixlet/documents/qna-5.0.3.0.zip

Note that this document is far from a comprehensive resource on the relevance and action languages. For this, please consult the references listed below.

References

The following documents should serve as valuable resources both while working through this guide and while subsequently beginning to write custom content. They contain more examples, and comprehensive lists of available commands and syntax:

BigFix Windows Inspector Library (http://support.bigfix.com/fixlet/documents/WinInspectors- 2004-04-07.pdf) BigFix Windows Shell Action Commands (http://support.bigfix.com/fixlet/documents/WinActions-2003-05-27b.pdf) BigFix Windows Relevance Language Quick Reference Guide BigFix Action Language Quick Reference Guide

The BigFix Windows Inspector Library is a technical document that lists the creation mechanisms and properties of all valid objects in the relevance language. This comprehensive guide is a very valuable resource for writing more difficult Fixlet messages. If you feel like you need a query that isn’t mentioned in this guide, or are just curious as to what is available, the Windows Inspector Library is the place to look.

6 ©2005 by BigFix, Inc. The BigFix Windows Shell Action Commands document contains most of the available actions in the BigFix Action Language. The action section in this document contains most of the same information and is organized in a similar manner.

The help function of BDE gives much information on various relevance commands and actions. It contains many of the tables found in the Windows Inspector Library, along with other useful tips. This is an invaluable resource one may use while writing Fixlet messages.

Also, the Configuration Manager page on the BigFix Support Site contains useful information. It can be found here: http://support.bigfix.com/fixlet/configmanager.html

Conventions Used in this manual

This document makes use of the following conventions and nomenclature: Convention Use

Mono-space A mono-spaced font is used to indicate expressions in the Relevance Language. bold Bold is used to denote returned values from relevance expressions

Angle brackets are used to indicate an object type. For instance to indicate the creation and usage of a particular object, you might see default value of which indicates that a registry key is to follow the default value keyword. Examples Square bullets and a mono-spaced font denote examples of Inspectors as used in a Relevance Expression. If you have a color version of this file, these square bullets are also red:

„ exists folder “fonts” of folder “c:\windows”

7 ©2005 by BigFix, Inc.

Types of Custom Content

What is a Fixlet® message?

The BigFix system is a powerful support technology that allows you to create “Intelligent” messages, which identify problems on a computer, and offer them a single-click solution. Fixlet messages are created using the BigFix Development Environment or the BES Console, and are generally simple and quick to produce. It is useful to think of a Fixlet message as the sum of three constituent parts: Fixlet Relevance, Fixlet Body, and Fixlet Action. Fixlet Relevance is the “brain” of the Fixlet message that identifies specific problem conditions that the Fixlet describes and fixes. Fixlet Relevance is written in the BigFix Relevance Language, and it allows Fixlet messages to target only computers with specific characteristics that indicate it has a problem. A Fixlet is defined as ‘Relevant’ for a certain computer if all of its relevance statements return True for that specific computer. Fixlet Body is the text (which can be formatted using standard HTML) of the Fixlet message, which explains the problem and gives the user any pertinent information they may need. The body should be concise, containing only important information. Fixlet Action is the process that solves the problem, allowing the user to click on a single link to resolve the issue quickly and simply. A Fixlet action may only be taken on a computer where the Fixlet is relevant.

Fixlet messages Vs. BES Tasks

BES Tasks are essentially the same as Fixlet messages, but they are a different category for organizational purposes. By definition, Fixlet messages are meant to be an identification and remediation of a problem. When the action of a Fixlet message is taken, it should ‘solve’ the problem. BES Tasks, on the other hand, perform maintenance and management functions that don’t necessarily address problems. For instance, BES Tasks can be used to deploy software, restart services, or run backups. BES Tasks have the same makeup as a Fixlet messages (relevance, actions, and body), and they interact with the BES Console and BES Clients in essentially the same manner. The only functional difference is that by default Fixlet actions will report back as ‘Fixed’ once their relevance has falsified, while by default Task actions will report back as ‘Fixed’ once all lines of its action have completed. For historical purposes, this guide will generally talk about Fixlets, but all content is applicable to BES Tasks as well.

Here is an example of a Fixlet message as seen by a console operator. The body is the text in the middle, and the two links that say ‘Click Here’ are actions. The other links and graphics are part of

8 ©2005 by BigFix, Inc. the Fixlet template, can be customized using BDE (template design will not be covered in this guide.)

BES Retrieved Properties

Retrieved properties are an essential part of the BigFix Enterprise Suite. BES Retrieved Properties are certain pieces of information that are gathered from each BES Client and stored in the database on the BES Server. This information is displayed in the BES Console and can be used to define management rights for BES Console operators and target actions to specific subsets of computers. Retrieved properties are written in the BigFix Relevance Language. Each Retrieved Property is simply a return value of a query written in the BigFix Relevance Language.

BES Custom Actions A BES Custom Action contains the main constituent parts of a Fixlet message or BES Task, but is not saved for future application. When you write a BES Custom Action, you write the relevance and action scripts, and immediately send out the action to targeted computers. In general, you should only use a BES Custom Action if you want to perform a quick task that you only need to do once. Otherwise, it would be better to take advantage of the increased functionality of a Fixlet message or BES Task.

9 ©2005 by BigFix, Inc.

Initial Query Analysis

The BigFix Relevance Language forms that basis for most content in BES. BES Retrieved Properties are just evaluations of a relevance query. Whether or not Fixlet® messages or BES Tasks appear relevant in the BES Console is dictated by relevance clauses, which are written in the BigFix Relevance Language. A Fixlet message may contain many relevance clauses, all of which must return true for it to become ‘relevant’ for a certain computer. An expression will only lead to a Fixlet message becoming relevant if it successfully evaluates to True. A Fixlet action cannot be taken on a machine if any of its relevance clauses are false. This section of the guide will introduce basic relevance queries and techniques. We recommend that the reader use QNA to try out various queries, complete exercises, and get a general feel for the language. The QNA program is also built into BDE as the relevance evaluator. You may access the relevance evaluator by pressing CTRL- E.

The QNA Program

QNA is a simple program that analyzes relevance queries for the computer it is being run on. QNA comes installed with the BDE program. Here is a quick screenshot of the QNA program:

Use of the QNA program is straightforward. Simply type ‘Q:’ followed by a relevance clause, and click on the ‘Q/A’ button for evaluation. The QNA program can evaluate many queries at once, and will ignore all text not preceded by ‘Q:’. Here are some useful keyboard shortcuts:

CTRL-A: Evaluate all queries.

10 ©2005 by BigFix, Inc. CTRL-T: Evaluate all queries and display the time needed to complete each one in microseconds. CTRL-Q: Remove all query answers.

Although most relevance clauses take only a fraction of a second to evaluate, there are some larger ones that may take a significant amount of time to evaluate. When creating these clauses, it’s important to use syntax that will minimize the amount of time needed to evaluate the clause. In many cases, two statements that seem equivalent can have very different evaluation times. Evaluation time can always be checked in QNA by using CTRL-T.

Before we get into specifics, try re-creating some of simple queries above. Get QNA to display the amount of your computer’s RAM and the name of its operating system. Also, use CTRL-T to see how long it takes each one of these queries to evaluate.

Besides being a useful training tool, the QNA program will prove invaluable when one is creating a custom content. It’s a good way to figure out how relevance can be used to detect a problem, and can help throughout the entire debugging process.

Note! There is a problem with copying text from Microsoft Word into QNA. If you have an electronic version of this document and you try to copy relevance statements into QNA, the quotation marks won’t evaluate correctly. You will need to manually erase and retype quotation marks in the QNA program for the evaluation to work.

The Structure of BES Relevance - Object Types

The BES Relevance Language is build upon a multitude of objects and their various properties. Possibly one of the most difficult parts of writing relevance is keeping different objects straight. There are many types of objects (strings, integers, registry objects, versions, etc.), but sometimes it can be difficult to figure out which object type you have and which you need. It is useful to think of the BES Relevance Language in terms of objects and properties. Most queries are properties of an object that produce another object. Since the Windows Inspectors Library is organized according to objects, let’s a take a look at a piece of it.

11 ©2005 by BigFix, Inc.

This is a snapshot of the part of the Windows Inspector Library that deals with the object. As you can see, it is divided into two sections: Creation Methods and Properties. The ‘Creation Methods’ section tells you all the ways you can produce an object. In order to create an object you form a query of the form:

„ variable of

where the is the name of the environment variable, and is the object corresponding to the environment. You could also get a list of all your environment variables by typing:

„ variables of environment

If you were unsure how to create an object, you could look up the section of the Windows Inspectors Library that about the object, and look at the Creation Methods. As it turns out, you create an object by just writing environment. For instance, you could create an object corresponding to the computer name with the following query:

„ variable “Computername” of environment

From here you could query the various properties of the object. In order to return the name or value of the environment variable, you would use the following commands, respectively:

12 ©2005 by BigFix, Inc.

„ Value of varaiable “computername” of environment „ Name of variable “compuername” of environment

As you can see from the chart, each of the command returns an object of type . As I introduce the various commands, I’ll try to make a note of what object we’re dealing with. As I mentioned before, a comprehensive list of objects in the BES Relevance Language can be found in the BigFix Windows Inspectors Library. Also, the inspector library lists the object type of the parameter and return value for every command. The inspector library may be extremely useful if you find yourself having difficulties with object types.

TIP! Relevance expressions often fail because you pass the wrong object type to a command as a parameter. A great troubleshooting mechanism for relevance is to look at each command within a relevance clause and make certain that each command is getting passed the correct object type.

Basic Booleans

Many different types of information about a computer can be garnered from a relevance expression. Since for Fixlet messages we eventually want a complete relevance clause to return a Boolean True or False, let’s first look at operators that return a Boolean value. Although there are a few inspectors that return a Boolean value, there are two main ways to obtain a Boolean value: existence and comparison. You will use one of these tools in most relevance clauses.

Existence

In its most basic form, a relevance expression can check for the existence of an object on the users’ computer. Let’s say that you to write a Fixlet that would be relevant on all computers with “autoexec.bat” located at the root directory of the “c:” drive. The following would be the relevance statement:

„ exists file "c:\autoexec.bat"

In this case file "C:\autoexec.bat" defines a object. (We’ll go over the object in more detail shortly.) The result of the exists operator is a boolean value. In this case, it would return true if the file exists or false if it doesn't. Therefore, a Fixlet message with the example relevance clause would cause all computers with the file “autoexec.bat” at the root of their “c:” drive to report as relevant. You can also check for a folder using similar syntax:

„ Exists folder “c:\temp”

13 ©2005 by BigFix, Inc. Practice with QNA: Using QNA, try checking for the existence of various files and folders on your computer. Later, we’ll learn other objects we can check, and we’ll learn tricks to get around typing the complete pathname of a file. Can you answer the following questions about your computer using QNA? (Note: Answers to all the practice problems are available at the end of each section.)

Practice Using QNA:

1. Does the folder “c:\winnt” exist on your computer? 2. Does this folder contain “explorer.exe”? Link to Answers

Comparison

The second basic form of a Relevance clause involves the comparison of two expressions:

Here's an example of this form using an equal sign as the comparator:

„ number of processors = 2

The result is true only if both expressions are equal to each other. If they are not equal -- or if there is some kind of error -- the expression will be false. Here’s an example of comparing two relevance expressions using a ‘greater than’ sign:

„ Version of file “c:\temp\prog1.exe” > version of file “c:\temp\prog2.exe”

We will explore the version command a bit later.

Here is a list of all of the comparators that can be used in the Relevance Language, with examples of how they can be used:

= 5/2 = 2.5 != 5/2 != 3 < 5 < 6 > 6 > 5 <= 5 <= 6 >= 6 >= 6

14 ©2005 by BigFix, Inc. contains "xyz" contains "y" does not contain "xyz" does not contain "bc" does not end with "xyz" does not end with "abc" does not equal "abc" does not equal "Abc" does not start with "abc" does not start with "bc" ends with "abc" ends with "bc" equals 5 = 4+1 is 1 is 1 is contained by "y" is contained by "xyz" is equal to 1 is equal to 1 is greater than 2 is greater than 1 is greater than or equal to "banana" is greater than or equal to "apple" is less than 4 is less than 5 is less than or equal to 5 is less than or equal to 5 is not 1 is not 0 is not contained by "fuz" is not contained by "foo" is not equal to "foo" is not equal to "bar" is not greater than "foo" is not greater than "bar" is not greater than or equal to 5 is not greater than or equal 4 is not less than 5 is not less than 3 is not less than or equal to 5 is not less than or equal to 5 starts with "good" starts with "goo"

Operators

The examples in the comparator list above represent simple relevance clauses. However, larger Relevance clauses can be more complicated, describing very specific computer configurations and processes. When dealing with these more complex Relevance clauses, it is often useful to break them down into smaller expressions. In some cases, more complex expressions can themselves be broken down into simple "sub-expressions”. Each of these expressions and sub-expressions must be linked together with “operators”. Operators tell the Relevance Language how to relate two expressions or sub-expressions. For example:

„ 1 + 1 „ length of file "c:\autoexec.bat" / 512 „ number of files of system folder mod 10

Here is a list of all of the operators in the Relevance Language:

15 ©2005 by BigFix, Inc.

( begin sub-expression ) end sub-expression * integer multiply / integer divide + integer plus - integer minus & string concatenate mod integer modulo not boolean negate and logical and or logical or

File System Objects

Using the Relevance Language, a multitude of information can be inspected from a computer. A complete list of inspectors would take up many pages, so instead I’ll try to introduce some of the more common inspectors and their uses. For a detailed list of every inspector, please refer to the Windows Inspector Library.

The Folder Object

The object refers to a folder in the windows operating system. The most common creation methods are:

Creation Methods

16 ©2005 by BigFix, Inc.

Here are some syntax examples:

„ Exists folder “C:\Program Files\BigFix” „ Exists parent folder of system folder

The windows folder and system folder commands are special queries that return a object corresponding to the windows or system folder. Since these folders are located in different locations for different operating systems, these commands are very useful.

An important note on the object is that is has no default return value. Therefore, if you construct a query that returns a , the query will return an error. Instead of returning a , you have to return a property of a folder. Here are a few common properties of a .

Properties

17 ©2005 by BigFix, Inc.

As you can see, parent folder of and folder of folder both return objects, so they are creation methods as well. Syntax examples:

„ Name of windows folder = “WINDOWS” „ Pathname of parent folder of system folder = “C:\WINDOWS”

The File Object

Possibly the most basic object in the relevance language is the object. The most common creation methods for a are:

Creation Methods

In the first example, the is the complete path of the file. For instance,

„ Exists File “c:\windows\notepad.exe”

Since files and folders are not always in the same place on every computer, and it would be difficult to always write relevance that refers to a file that you want to analyze by a specific pathname. Also, you cannot find a file of an unknown location by simply searching through the file system, as this would be an incredible drag on system resources of the computer running the BES Client. Fortunately, while the main ways of creating a object are to use the path of the file or its containing folder, you can generally find this information without needing to hard-code paths. Also, there are special commands for applications that assist with locating many files. We’ll take a look at these shortly. First, however, let’s examine some properties of a .

Properties

18 ©2005 by BigFix, Inc.

Here are examples of each of these inspectors, along with some sample return values from QNA:

19 ©2005 by BigFix, Inc.

As you can see, the phrase file “mshtml.dll” of system folder defines a object, from which various properties are queried. The sha1 inspector stands for ‘Secure Hash Algorithm’, and it is a simple checksum that is used to verify the integrity of downloaded files. You will need to use this along with the size inspector to create downloads in a Fixlet action. Practice with QNA:

3. What is the version of the file “tcpip.sys”? This file is located in the folder “Drivers”, which is in the system folder. 4. Write a relevance statement that will only return true if the size of the file “url.dll” is 106496 and its sha1 is b53aadb418dfb956e7aebef60d924ef990f919e6. Url.dll is found in the system folder. Since a sha1 hash is a string, it must be entered in quotes in a relevance statement.

Link to Answers

Plurals

Most objects can be made plural by adding an ‘s’ at the end of them. If a plural query returns multiple results, it will return a list with all the possible return values. Later on, we will look at how to filter a list. Syntax Examples:

„ Files of windows folder „ Names of files of system folder

You can query the number of items in a list using the number of command.

„ Number of folders of system folder

Applications

The relevance language can access certain applications without knowing the path to their executable. An object inherits all the characteristics of the object for the application’s executable. For all practical purposes, you can think of an as simply being a nifty way to access the executable file for a program. The three main types of applications recognized by the relevance language are registered applications (regapps), running applications, and recent applications.

20 ©2005 by BigFix, Inc. Programs that are installed correctly according to windows guidelines create a key under the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths. Applications that have a key entry here can be accessed using the regapp command:

„ Version of regapp “BesClient.exe” „ Pathname of regapp “outlook.exe”

Here are some examples of the regapp command.

As I mentioned before, the parent folder command errors out if used by itself because it returns an object type of “folder”, which has no specified display value. Instead, you have to return a certain characteristic of the folder by using name of parent folder or pathname of parent folder, etc.

You can use all the same commands for running or recent applications. You can see a list of all your regapps, running, or recent applications by using the following commands:

„ Regapps „ Running Applications „ Recent Applications

21 ©2005 by BigFix, Inc. Note! The running and recent applications inspectors do not quite work correctly in QNA. This list of running and recent applications does not always get updated while running a session of QNA, so you have to close and re-open the program to get an updated list of running applications.

Practice with QNA:

5. Do you have more files in your windows folder than you have recent applications? 6. List all the pathnames of your running applications. 7. List all your regapps. Pick one and display its pathname and parent folder. (Two separate clauses)

Link to Answers

Versions

As we’ve seen before, a version is a property of a file. Querying the version of a file returns a object.

„ version of file “cmd.exe” of system folder „ version of regapp “bde.exe” > “2.0”

The object has a few special properties, and since its so commonly used it’s worth going into it in some detail. A version consists of up to four integers separated by periods, such as 5.01.235.435. When comparing versions, the Relevance Language compares the four integers one by one, from the left to the right. It considers two versions as equal if all available integers are equal. For instance, “5.1” < “5.10”, since 5=5 but 1<10. This comparison is somewhat different than if we were dealing with similarly formed strings. This is all a bit easier to explain by example:

22 ©2005 by BigFix, Inc.

As you can see, the comparisons work a bit differently if you are working with strings or versions. The main difference is that you can just check the major version of a file by comparing it to a single integer. You can cast a string into a version by using the as version command, and vice versa.

One more important thing to note about versions is that the version inspector doesn’t always return exactly the same version as you would see by right-clicking a file and selecting ‘properties’. Usually, the difference is something seemingly trivial such as trailing zeroes, but this can make a big difference when comparing versions. Whenever possible, check a file version using QNA to make sure you know the version as interpreted by the Relevance Language.

TIP! Not all files have versions. You can check with the query exists version of file

Practice With QNA:

8. What is the version of your “regedit.exe” file? 9. What is your version of Internet Explorer? (Hint, it’s a regapp) 10. Formulate a relevance expression to check whether one has IE5, and another one to see if they have IE6? 11. Write a relevance expression to check the version of the file “msoe.dll”, which is a file used by Outlook Express. This file will be in the same folder as the regapp “msimn.exe”. Hint: use parent folder of regapp 23 Link to Answers ©2005 by BigFix, Inc.

Operating System

You can create an object corresponding to the local OS by simply writing operating system. The two most common expressions involving the object are:

„ Name of operating system „ Csd version of operating system

Name of operating system returns a string based on the operating system. Possible return values for this query on windows operating systems are WinNT, Win95, Win98, WinME, Win2000, WinXP, Win2003.

Csd version of operating system returns a string containing the service pack of the operating system. In general, the return value of csd version of operating system returns a string of the form of Service Pack X where X stands for the number of the service pack. Here are some syntax examples:

„ csd version of operating system = “Service Pack 1” „ csd version of operating system = “”

If there is no service pack, the csd version is just an empty string, “”.

Practice with QNA:

12. What service pack are you running? 13. How would you check to see if a computer had any service pack installed?

Link to Answers

Strings

24 ©2005 by BigFix, Inc. So far we’re seen many objects that either require strings for their creation or output their properties as string, so we may as well address them directly. A string is simply a text expression, and it is entered into a relevance statement surrounded by quotes.

Since strings are so prevalent, there are many commands that are used to extract specific information from a string. When you want to use these commands, it is important to make sure you’re dealing with a string. More complicated expressions also make use of the object, which is useful for parsing strings. Other types of objects can be converted to strings using the as string command. Here are some useful commands:

„ First/Last of

Returns a substring of the first/last of characters of the string

„ (contains/starts with/ends with)

This will return a boolean value based on whether or not contains/starts with/ends with .

„ following text of of

Returns corresponding to the part of the original string that follows the named substring. For more information on using substrings, please see the Inspector Library.

Also, you can concatenate a string using the & operator.

The following QNA example should make these commands a bit more clear:

25 ©2005 by BigFix, Inc.

It can take a little practice to learn how to extract the correct information from a string, but eventually it becomes second nature.

Practice With QNA:

14. Write a relevance statement that will return true on all Windows operating systems. 15. Write a relevance expression that will output just the number of the installed service pack. 16. Create another relevance statement that will output the version of msoe.dll. This time, however, don’t use the parent folder of regapp command. Instead, create the full path to the file direct by parsing the pathname of the regapp msimn.exe and concatenating the correct filename onto the end.

Link to Answers

Registry Commands

26 ©2005 by BigFix, Inc. When writing relevance, the Windows registry can be a gold mine of information. The registry is a database contained in every Windows operating system that stores data about a computer. The registry is organized into a tree of folders called keys. A key can have many subkeys, which can have many subkeys, etc. Each key can contain information in the form of values. You can see or edit the registry by running the regedit.exe program, which is included with Windows. You can run it by going to Start>Run> and type “regedit”.

Note! Be careful when working in regedit or using .reg files. A wrong move could damage your computer irreparably.

27 ©2005 by BigFix, Inc. Creation Methods

Key Phrase Form Description key of Named Creates an object for the named sub-key of the key. key of Named Creates an object for the named key. The name may be a full path to a key of the form "HKEY_CLASSES_ROOT\Fixlet.Pool\".

All registry commands must originate from a object. Fortunately, a object is created by simply writing registry.

Properties

Key Form Return Type Description Phrase key Named key> of name of Plain Returns the name of the key as a string. value Named value> registry key value. of

Like the object, the object has no default return value. Therefore, a registry command that returns a object will error out. Instead, you need to query the name of the key or a value in the key. Here are some syntax examples.

„ exists key “HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\Enterprise Server” of registry

28 ©2005 by BigFix, Inc.

„ value "IsInstalled" of key "HKLM\SOFTWARE\Microsoft\Updates\ DataAccess\Q318203" of registry = 1

Basically, you just need to keep two things in mind to avoid making syntactical mistakes while forming registry queries.

1. All values and key names must be surrounded by quotes. 2. It’s necessary to write of registry after the key name.

As you may have noticed from the examples, you can abbreviate the hives of the Registry. Here are the abbreviations:

HKEY_Classes_Root = HKCR HKEY_Current_User = HKCU HKEY_Local_Machine = HKLM HKEY_Users = HKU HKEY_Current _Config = HKCC

Tip: Values from the registry are pre-defined as registry objects. Basically, this just means that, even if they look like a string, folder, or time, you have to cast the value into the type you want. You can do this by using the commands as time, as folder, and as string. Take a look at this QNA example:

29 ©2005 by BigFix, Inc.

As you can see, in order to perform a string operation (first 3 of) on a registry value, I had to use the as string command. In order to look for a file within the folder, I could either cast the value as a string and use the folder command (which expects a string as its argument), or I could simply cast it as a folder. One exception to this rule is Reg_Dword values, which return as integers.

Note! The BigFix Enterprise client runs its queries as the System user. Therefore, a Fixlet message inspecting HKCU will report values for the system user, not the currently logged in user.

Practice with QNA:

17. Write a command that will return true if a user has ever installed a certain Internet Explorer patch on their computer. The following key will get created once the patch in installed: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2298d453-bcae-4519-bf33-1cbf3faf1524} 18. Now check to see if the patch is actually installed at the moment. If it is, it will have a Dword value of “IsInstalled” set to 1. 19. Find the version of wab32.dll, a component of the Windows Address Book. You can find the complete path to this file by checking out the following key- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WAB\DLLPath. Hint: You can query the default value of a key using default value of .

Link to Answers

Time

There are a number of times that can be analyzed using the Relevance Language. The simplest command is the now command, which just returns the current time according to the operating system’s clock. d = Day of the week Q: now D = Day of the month A: Mon, 03 Feb 2003 16:30:08 –0800 m = Name of the Month Y = Year Time is displayed in the following format (MIME standard): H = Hour M = Minute ddd, DD mmm YYYY HH:MM:SS sZZZZ S = Second sZZZZ corresponds to the time zone. For instance , -0800 corresponds to 8 hours before Greenwich Mean Time. 30 (US ©2005 Pacific by Time) BigFix, Inc.

Here are a few inspectors that return a time:

„ Modification time of file „ Creation time of file „ Accessed time of file „ Boot time of operating system

The modification time inspector is probably the most useful, as it can be used to compare two different files that either have the same version or no version. When two times are compared, the greater time is defined as being more recent. The sum or difference of two times gives an answer in days, hours, minutes, and seconds. (of the form dd:hh:mm:ss.sss) Here are some examples:

„ modification time of regapp "NsRex.exe" < "Thu, 01 Jun 2000 00:00:00 -0800" as time „ modification time of file “file.dll” of system folder > creation time of “file.dll of system folder „ now – modification time of file “c:\bigfix\subscribe.dll” > 3*day

One can compare the difference of two times to days, hours, or seconds. As shown above, this data type is constructed by *. Available time intervals are microsecond, millisecond, second, minute, hour, day, week. Also, if you want to type a time into a relevance clause (or extract one from the registry), as in the first example, you need to cast it as a time by writing as time.

Services

The Relevance Language can query installed services on a computer. Creation Methods

Key Phrase Form Description running service PlainGlobal Creates objects corresponding to all the running services. running service NamedGlobal Creates the running service object for the specified name. service PlainGlobal Creates objects for all the services. service NamedGlobal Creates the service object matching the specified

31 ©2005 by BigFix, Inc.

Key Phrase Form Description name, regardless of its running state.

You can see a list of services or running services by evaluating the queries services and running services respectively. Here are some examples:

„ Exists service “BesClient” „ Exists running service “Messenger”

Properties

Key Phrase Form Return Description Type display name of Plain Returns the display name of the service. login account of Plain Returns the login account under which the service is configured to run. state of Plain Returns one of Continuing, Pausing, Paused, Running, Starting, Stopping, Stopped, Unknown.

Here are some more examples:

„ State of service “DCHP” = “Running” „ Login account of service “Messenger”

Note: You can gain additional information about services and make changes in their settings using the registry keys located at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\

32 ©2005 by BigFix, Inc.

Practice with QNA:

20. What time is it now? 21. How long has it been since explorer.exe has been modified? 22. Has it been more than a day since the computer has been started. Hint: boot time of operating system gives the time of last boot. 23. What is the state of the Task Scheduler service on your computer? (Note, ‘Task Scheduler’ is the Display Name, not the service name.)

Link to Answers

Hardware

There are a number of inspectors that investigate the hardware of a machine. Since these are generally used less frequently than the software inspectors, I’ll just go over few of the more common examples.

RAM

You can return the amount of RAM on your computer using the command:

„ Size of ram

This command returns an corresponding the amount of Ram in bytes. If you want to return the amount of Ram in MB, you can divide by (1024*1024).

„ Size of ram / (1024*1024)

Processor

The object refers a processor on the computer.

Creation Methods

33 ©2005 by BigFix, Inc.

Key Phrase Form Description main processor PlainGlobal Creates the object associated with the 'Primary' processor. On most systems this is the only processor. processor PlainGlobal Iterates through the processors in the system. processor NumberedGlobal Creates the processor object for the number specified. The first processor is processor number 1.

On single-processor machines, the easiest way to create a object is simply to write processor. Properties

Key Phrase Form Return Description Type family name of Plain Returns the family name of the CPU, e.g., • Athlon, • Duron, • Pentium 4. vendor name of Plain The manufacturer of the CPU. Names include: • GenuineIntel, • AuthenticAMD, • CyrixInstead, speed of Plain Returns the speed of the processor in Hertz. This inspector measures the speed if the vendor name is GenuineIntel.

Here are some syntax examples:

„ vendor name of processor = “GenuineIntel” „ Family name of main processor = “Pentium M”

It is important to notice that the speed of command returns not an , but a object. The object is especially formulated for easy conversion to Mhz, Khz, or Ghz. For instance, if

„ Speed of processor

Returns 600000000 hertz, then 34 ©2005 by BigFix, Inc.

„ Speed of processor / Mhz

Will return 600.

Network Adapter

You can create a object by writing adapter of network. Since there are frequently multiple network adapters present on computers, you may want to make this statement plural to see all the adapters:

„ Adapters of network

Properties

Key Phrase Form Return Description Type address of ‡ address> adapter (returns the first address if it is a list). description of Plain Returns the description of the network ‡ adapter. dhcp server of Plain ‡ address> the network adapter. dns server of Plain ‡ address specified adapter. list>

Here are some syntax examples:

„ Addresses of adapters of network „ Description of adapter of network

35 ©2005 by BigFix, Inc.

Practice with QNA:

24. How much RAM do you have on your computer? Output the results so they look like this: 256 MB RAM 25. Write a relevance expression that will only be true if your processor is made by Intel and its speed is less than 800 Mhz. 26. Write a query to output the dhcp servers of all your network adapters.

Link to Answers

36 ©2005 by BigFix, Inc.

Practice Problem Answers

1. Does the folder “c:\winnt” exists on your computer?

„ Exists folder “c:\winnt”

2. If so, does this folder contain “explorer.exe”?

„ Exists file “explorer.exe” of folder “c:\winnt” OR

„ Exists file “c:\winnt\explorer.exe”

These statements will always return the same value, but the second example evaluates in significantly less time. Referencing a file by complete pathname is usually the quickest way to access it.

3. What is the version of the file “tcpip.sys”? This file is located in the folder “Drivers”, which is in the system folder.

„ Version of file “tcpip.sys” of folder “Drivers” of system folder

4. Write a relevance statement that will only return true if the size of the file “url.dll” is 106496 and its sha1 is b53aadb418dfb956e7aebef60d924ef990f919e6. Url.dll is found in the system folder. Since a sha1 hash is a string, it must be entered in quotes in a relevance statement.

„ Size of file “url.dll” of system folder = 106496 AND sha1 of file “url.dll” of system folder = “b53aadb418dfb956e7aebef60d924ef990f919e6”

Note: Later we’ll get around having to say file “url.dll” of system folder multiple times.

5. Do you have more files in your windows folder than you have recent applications?

„ number of files of windows folder > number of recent applications

6. List all the pathnames of your running applications.

37 ©2005 by BigFix, Inc.

„ Pathnames of running applications

7. List all your regapps. Pick one and display its pathname and parent folder. (Two separate clauses)

„ Names of regapps „ Pathname of regapp “bde.exe” „ Pathname of parent folder of regapp “bde.exe”

8. What is the version of your “regedit.exe” file?

„ Version of file “regedit.exe” of windows folder

9. What is your version of internet explorer? (Hint, it’s a regapp)

„ Version of regapp “iexplorer.exe”

10. Formulate a relevance clause to check whether one has IE5, and another one to see if they have IE6?

„ Version of regapp “iexplorer.exe” = “5” „ Version of regapp “iexplorer.exe” = “6”

11. Write a relevance expression to check the version of the file “msoe.dll”, which is a file used by Outlook Express. This file will be in the same folder as the regapp “msimn.exe”. Hint: use parent folder of regapp

„ Version of file “msoe.dll” of parent folder of regapp “msimn.exe”

38 ©2005 by BigFix, Inc.

12. What service pack are you running?

„ Csd version of operating system

13. How would you check to see if a computer had any service pack installed??

„ Csd version of operating system != “”

14. What relevance would return true for all Windows Operating Systems?

„ Name of operating system contains “Win”

15. Write a relevance statement that would output just the number of the service pack

„ Last 1 of csd version of operating system 16. Create another relevance statement that will output the version of msoe.dll. This time, however, don’t use the parent folder of regapp command. Instead, create the full path to the file direct by parsing the pathname of the regapp msimn.exe and concatenating the correct filename onto the end.

„ Version of file (preceding text of last “\” of pathname of regapp “msimn.exe” & “\msoe.dll”)

17. Write a command that will return true if a user has ever installed a certain Internet Explorer patch on their computer. The following key will get created once the patch in installed: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2298d453-bcae-4519-bf33-1cbf3faf1524}

„ Exists key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2298d453-bcae-4519- bf33-1cbf3faf1524}” of registry

39 ©2005 by BigFix, Inc.

18. Now check to see if the patch is actually installed at the moment. If it is, it will have a Dword value of “IsInstalled” set to 1.

„ Value “IsInstalled” of key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2298d453-bcae-4519- bf33-1cbf3faf1524}” of registry = 1

19. Find the version of wab.dll, a component of the Windows Address Book. You can find the complete path to this file by checking out the following key- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WAB\DLLPath. Hint: You can query the default value of a key using default value of .

„ Version of (value of key “HKLM\Software\Microsoft\WAB\DLLPath” of registry as file)

20. What time is it now?

„ Now

21. How long has it been since explorer.exe has been modified?

„ Now – modification time of file “explorer.exe” of windows folder

22. Has it been more than a day since the system has been restarted?

„ now – boot time of operating system > 1*day

23. What is the state of the Task Scheduler service on your computer? (Note, ‘Task Scheduler’ is the Display Name, not the service name.)

40 ©2005 by BigFix, Inc.

„ State of service “Schedule”

24. How much RAM do you have on your computer? Output the results so they look like this: 256 MB RAM

„ ((Size of RAM / (1024*1024)) as string) & “ MB RAM”

25. Write a relevance expression that will only be true if your processor is made by Intel and its speed is less than 800 Mhz.

„ Vendor name of processor = “GenuineIntel” AND speed of processor /Mhz < 800 26. Write a query to output the dhcp servers of all your network adapters.

„ Dhcp servers of adapters of network

41 ©2005 by BigFix, Inc.

Advanced BES Relevance Syntax

If/Else/Then

The BES Relevance Language supports basic if/then/else logic within a single relevance statement. The general syntax is:

„ If then